Skip to content
Sign in Waitlist
Docs/API reference/Webhooks/Create webhook

Create webhook

POST /v1/webhooks scope admin

Creates a webhook. The url must be https on a public host (private IPs, localhost and cloud metadata addresses are refused with unsafe_url). The signing secret is returned ONCE. At most 10 per workspace.

HeadersAuthorization: Bearer praeko_… and X-Praeko-Contract: en. Always send both.

Parameters

Name In Description
Idempotency-Key header Idempotency key (1 to 255 visible characters, for example a UUID). Repeating the SAME request with the same key within 24 h returns the stored response (with Idempotent-Replayed: true) without running it again; a different request with the same key returns 422 idempotency_key_reuse; a request still in progress returns 409 idempotency_in_progress. 5xx errors are not stored. The key is scoped per workspace and per route. See Retry a request safely.

Request body

JSON. Required fields must be sent; the others can be left out.

Field Type Description
url required string URL that receives the events. Must be https on a public domain (no user and password; private IPs, localhost and internal names are refused with unsafe_url). Up to 2048 characters.
events (optional) string[] Events that trigger the webhook. At least one. Values: post.sent, post.failed, post.scheduled-fail; default: post.sent, post.failed.
active (optional) boolean Whether the webhook starts enabled. Default: true.
Body example
{
  "url": "https://example.com/hooks/praeko",
  "events": [
    "post.sent",
    "post.failed"
  ],
  "active": true
}

Example

curl -X POST "https://praeko.app/v1/webhooks" \
  -H "Authorization: Bearer $PRAEKO_KEY" \
  -H "X-Praeko-Contract: en" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com/hooks/praeko",
  "events": [
    "post.sent",
    "post.failed"
  ],
  "active": true
}'

Response

Success status When
200 Success.
Response 200
{
  "id": "wh_01KA3X4D8P6TQ1VZ0C7MH2NB5R",
  "url": "https://example.com/hooks/praeko",
  "events": [
    "post.sent",
    "post.failed"
  ],
  "active": true,
  "secretHint": "whsec_…k3Qw",
  "consecutiveFailures": 0,
  "createdAt": "2026-11-07T14:02:11.482Z",
  "updatedAt": "2026-11-07T14:02:11.482Z",
  "secret": "whsec_8vN2xQe4L1mTz7Hc0Yb5Wd3KfRj6PaUo9GtSi2XnVEw",
  "warning": "store this secret now: it will not be shown again"
}

warning is free text the server writes in Portuguese; the example shows it in English.

Errors

Status code When
400 empty_body The request body is empty.
400 invalid_json The request body is not a JSON object.
413 body_too_large The request body is larger than 1 MB.
422 invalid_field url missing or events empty/unknown.
422 unsafe_url The url is not https, or points to a private network or localhost.
409 webhook_limit_reached This workspace already has 10 webhooks.
422 idempotency_key_reuse The Idempotency-Key was already used with a different request (different method, path, query or body).
409 idempotency_in_progress A request with the same Idempotency-Key is still in progress (retry in a moment).
409 idempotency_response_too_large The original response was larger than 256 KB and was not stored; fetch the resource with GET instead.

Errors on any route

Status code When
401 unauthorized The Authorization: Bearer … header is missing.
401 invalid_api_key The key does not exist.
401 revoked_api_key The key has been revoked.
401 expired_api_key The key has expired.
403 forbidden The key's scope is not enough for this route (see the scope badge).
429 rate_limited The per-minute request limit was exceeded.

The body of every error is { "error": { "code", "message", "details"? } }. See all error codes.

Try it

Try it

The live test uses your key and your account. It stays off when you are not signed in.

Sign in to try it
Question or mistake on this page? contato@praeko.appView .md

Type to search pages, routes and error codes.